Bump the ci-constraints group across 1 directory with 7 updates by dependabot[bot] · Pull Request #55 · microsoft/bocpy

dependabot · 2026-07-27T13:47:45Z

Bumps the ci-constraints group with 7 updates in the /ci directory:

Package	From	To
certifi	`2026.6.17`	`2026.7.22`
charset-normalizer	`3.4.7`	`3.4.9`
filelock	`3.29.5`	`3.32.0`
platformdirs	`4.10.0`	`4.11.0`
coverage	`7.15.0`	`7.15.2`
asttokens	`3.0.1`	`3.0.2`
soupsieve	`2.8.4`	`2.9.1`

Updates certifi from 2026.6.17 to 2026.7.22

Commits

f4bc676 2026.07.22 (#428)
4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
474e6fc Include tests in the source distribution (#424)
a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
See full diff in compare view

Updates charset-normalizer from 3.4.7 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)

Unnecessary json import at runtime (#753)

Inverse capitalization not seen by noise detector (#731)

Changed

No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.

Micro-optimizations in our noise / coherence measurements.

No longer using regex search by default for our preemptive charset mark algorithm.

Raised upperbound of setuptools to v83.

Raised upperbound of mypy(c) to v2.1.

Removed

Redundant UTF7 BOM marker (#730)

Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)

Unnecessary json import at runtime (#753)

Inverse capitalization not seen by noise detector (#731)

Changed

No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.

Micro-optimizations in our noise / coherence measurements.

No longer using regex search by default for our preemptive charset mark algorithm.

Raised upperbound of setuptools to v83.

Raised upperbound of mypy(c) to v2.1.

Removed

Redundant UTF7 BOM marker (#730)

Commits

cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
152b923 chore: release 3.4.9
2bc2607 fix: unicodedecodeerror in fallback path
be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
a6f8feb Merge pull request #770 from jawah/unblock-ci
528e16c chore: add osv-scanner.toml
5993498 chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le
aa2ddd8 Release 3.4.8 (#766)
Additional commits viewable in compare view

Updates filelock from 3.29.5 to 3.32.0

Release notes

Sourced from filelock's releases.

3.32.0

What's Changed

👷 ci: add Python 3.15 to the test matrix by @gaborbernat in tox-dev/filelock#683

🐛 fix(packaging): let an unpacked sdist run the test suite by @gaborbernat in tox-dev/filelock#685

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

3.31.2

What's Changed

🐛 fix(strict): tolerate an errno without ENOTSUP by @gaborbernat in tox-dev/filelock#681

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

3.31.1

What's Changed

♻️ refactor(coverage): key exclusions on probed capability by @gaborbernat in tox-dev/filelock#679

scope a lease's claim to the context that acquired it by @dxbjavid in tox-dev/filelock#680

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

3.31.0

What's Changed

✨ feat(platform): support Termux/Android by @gaborbernat in tox-dev/filelock#678

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

3.30.3

What's Changed

Keep both tables of contents on screen at any browser font size by @gaborbernat in tox-dev/filelock#673

📝 docs(mermaid): follow the light and dark theme toggle by @gaborbernat in tox-dev/filelock#674

asyncio: scope the reentrant-deadlock registry to the owning task by @xt-yin in tox-dev/filelock#676

New Contributors

@xt-yin made their first contribution in tox-dev/filelock#676

Full Changelog: tox-dev/filelock@3.30.2...3.30.3

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.1 (2026-07-26)

Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685

Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683

The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

3.31.0 (2026-07-18)

Support Termux/Android, whose CPython ships without os.link and reports sys.platform == "android". import filelock and both FileLock and SoftFileLock now work there, StrictSoftFileLock reports its missing hard-link support only when acquired, and process liveness reads /proc on Android instead of PID-only checks. :pr:678

StrictSoftFileLock no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no

... (truncated)

Commits

76525e6 Release 3.32.0
9824d15 🐛 fix(packaging): let an unpacked sdist run the test suite (#685)
f6c41e9 👷 ci: add Python 3.15 to the test matrix (#683)
caeb1c9 Release 3.31.2
60eda0f 🐛 fix(strict): tolerate an errno without ENOTSUP (#681)
c1b2e6f Release 3.31.1
9fd7de5 scope a lease's claim to the context that acquired it (#680)
2b3ad2c ♻️ refactor(coverage): key exclusions on probed capability (#679)
3b66fdc Release 3.31.0
166b2b5 ✨ feat(platform): support Termux/Android (#678)
Additional commits viewable in compare view

Updates platformdirs from 4.10.0 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

👷 ci: run the test suite against Python 3.15 by @gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

🐛 fix(windows): stop leaking memory on repeated folder lookups by @gaborbernat in tox-dev/platformdirs#507

🚀 ci(release): towncrier changelog + publish on tag push by @gaborbernat in tox-dev/platformdirs#509

📝 docs(changelog): rebuild against release history by @gaborbernat in tox-dev/platformdirs#510

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.0 (2026-07-21)

Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491

Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490

Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen

Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber

Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

... (truncated)

Commits

2140495 Release 4.11.0
a562df9 👷 ci: run the test suite against Python 3.15 (#512)
7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
2e74013 Release 4.10.1
3076722 📝 docs(changelog): rebuild against release history (#510)
42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️ PyPI page: coverage 7.15.2. :arrow_right: To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.

A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️ PyPI page: coverage 7.15.1. :arrow_right: To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits

50d8659 docs: sample HTML for 7.15.2
b5eed20 docs: prep for 7.15.2
78cab6e fix: reduce memory use during reporting. #2229 (#2231)
b4c1fda build: bump version to 7.15.2
da63bed docs: sample HTML for 7.15.1
bc35e64 docs: prep for 7.15.1
182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
dd80635 fix: escape context labels in html report inline script block (#2224)
Additional commits viewable in compare view

Updates asttokens from 3.0.1 to 3.0.2

Release notes

Sourced from asttokens's releases.

v3.0.2

What's Changed

Modernize type annotations by @AlexWaygood in gristlabs/asttokens#172

Fix pypy CI by skipping redundant mypy runs on it by @dsagal in gristlabs/asttokens#173

Fix IndexError on source mixing lone CR with LF line endings (#105) by @apoorvdarshan in gristlabs/asttokens#174

Release modernization, and publish to PyPI from CI via trusted publishing by @dsagal in gristlabs/asttokens#175

New Contributors

@AlexWaygood made their first contribution in gristlabs/asttokens#172

@apoorvdarshan made their first contribution in gristlabs/asttokens#174

Full Changelog: gristlabs/asttokens@v3.0.1...v3.0.2

Commits

f97a6e1 Release modernization, and publish to PyPI from CI via trusted publishing (#175)
bb3c487 Fix IndexError on source mixing lone CR with LF line endings (#105) (#174)
d1eed10 Fix pypy CI by skipping redundant mypy runs on it (#173)
b8834d3 Modernize type annotations (#172)
See full diff in compare view

Updates soupsieve from 2.8.4 to 2.9.1

Release notes

Sourced from soupsieve's releases.

2.9.1

FIX: Correct [attr^=""], [attr$=""], and [attr*=""] to match nothing when the value is empty, per CSS Selectors Level 4 substring matching, which previously matched any element merely having the attribute (@chuenchen309).

2.9

NEW: Drop Python 3.9 support.

NEW: Lazy compile selector patterns to improve initial import speed.

FIX: Correct :nth-child/:nth-of-type (and -last- variants) for An+B values whose sequence steps onto index 0 or onto the last child (e.g. :nth-child(2n-2), :nth-child(n-1), :nth-child(n+5)), which previously matched the wrong elements or nothing at all (@gaoflow).

FIX: More efficient CSS ID matching (@kaimandalic).

FIX: Fix inefficient trimming of comments and white space (@kaimandalic).

Commits

05e92be Update changelog and bump version
9bd73eb Clean up comments and use a (?!) for unmatchable regex
8c5ceee Match nothing for empty-value substring attribute selectors (#298)
8763f91 Format changelog message
cf198fc Fix inefficient trimming of comments and white space
ce44e49 Merge commit from fork
751c57b Fix :nth-child/:nth-of-type matching for An+B index boundaries (#297)
08e9ede Drop Python 3.9
d6e6830 Rework selector mapping
d2d1581 Utilize property for accessing lazy regular expression pattern
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ci-constraints group with 7 updates in the /ci directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` | | [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.29.5` | `3.32.0` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.0` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.15.0` | `7.15.2` | | [asttokens](https://github.com/gristlabs/asttokens) | `3.0.1` | `3.0.2` | | [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.4` | `2.9.1` | Updates `certifi` from 2026.6.17 to 2026.7.22 - [Commits](certifi/python-certifi@2026.06.17...2026.07.22) Updates `charset-normalizer` from 3.4.7 to 3.4.9 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.4.7...3.4.9) Updates `filelock` from 3.29.5 to 3.32.0 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.29.5...3.32.0) Updates `platformdirs` from 4.10.0 to 4.11.0 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.10.0...4.11.0) Updates `coverage` from 7.15.0 to 7.15.2 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.15.0...7.15.2) Updates `asttokens` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/gristlabs/asttokens/releases) - [Commits](gristlabs/asttokens@v3.0.1...v3.0.2) Updates `soupsieve` from 2.8.4 to 2.9.1 - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.4...2.9.1) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.7.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: charset-normalizer dependency-version: 3.4.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: filelock dependency-version: 3.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: platformdirs dependency-version: 4.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: coverage dependency-version: 7.15.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: asttokens dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: soupsieve dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added ci dependencies labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the ci-constraints group across 1 directory with 7 updates - #55

Bump the ci-constraints group across 1 directory with 7 updates#55
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-23e1506051

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

Changed

Removed

3.4.9 (2026-07-07)

Fixed

3.4.8 (2026-07-06)

Fixed

Changed

Removed

3.32.0

What's Changed

3.31.2

What's Changed

3.31.1

What's Changed

3.31.0

What's Changed

3.30.3

What's Changed

New Contributors

4.11.0

What's Changed

4.10.1

What's Changed

7.15.2

Version 7.15.2 — 2026-07-15

7.15.1

Version 7.15.1 — 2026-07-12

Version 7.15.2 — 2026-07-15

Version 7.15.1 — 2026-07-12

v3.0.2

What's Changed

New Contributors

2.9.1

2.9

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants